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Issue # jj 

The Examiner has rejected Claims 1-7, 9-10, 12-20, 22-23, 25-28, and 30 under 35 U.S.C. 
103(a) as being unpatentable over "Q222193- Description of the Windows 2000 Windows File 
Protection Feature" (hereinafter WFP), in view of Rickey et al (U.S. Publication No. 
2002/0166059).. 

Group #1: Claims 1-2, 4-7, 13-15, 1 7-20, and 26-27 

With respect to the current grouping, and specifically appellant's claimed technique "wherein the 
factors are altered based on the monitoring of the requests to write to the files on the computer," 
the Examiner has responded to appellant's arguments, in the Office Action mailed 1/12/06, by 
Stating that '"when WFP is monitoring for modifications to files the write request is part of the 
change and therefore part of the monitoring." First, appellant respectfully asserts that what is 
claimed is "factors Tthatl are altered based on the monitoring of the requests" (emphasis added), 
and not merely monitoring write requests, as the Examiner argued Appellant emphasizes that 
WFP teaches that the "Windows File Protection feature is implemented when it is notified that a 
file in a protected folder is modified" and that a "second protection mechanism [is]. . .the System 
File Checker tool [that] scans all protected files to ensure they are not modified." Thus, WFP 
only discloses a situation where it is determined if a file has already been modified, and not 
altering factors cc based on the monitoring of the requests " (emphasis added), as claimed by 
appellant. Furthermore, WFP discloses restoring a file to a correct Microsoft version, but not 
altering factors associated with the computer, in the manner claimed by appellant, 

In the Examiner's Answer mailed 08/23/2006, the Examiner has argued that "[a]s described on 
page 4 of appellant's specification, 'the factors are selected from the group consisting of critical 
files, critical file locations, and trusted applications'" and that therefore "the critical files of WFP 
are the claimed factors." Further, the Examiner has argued that "since files are factors, as 
disclosed in appellant's specification, changing a modified file to a correct version is altering that 
factor." However, appellant respectfully points out that what is claimed is a technique "wherein 
the factors are altered based on the monitoring of the requests to write to the files on the 
computer" and the factors may include, but are not necessarily limited to "the group consisting of 
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critical files, critical file locations, arid trusted applications," as the Examiner's contends. Thus, 
despite the Examiner's arguments, WFP clearly fails to meet appellant's claimed "factors fthatl 
are altered based on the monitoring of the requests" (emphasis added), as claimed. 

Further, in the Examiner's Answer mailed 08/23/2006, the Examiner has argued that "WFP 
monitors a file system to determine when a file has been modified, and whenever a file is 
modified a write occurs in the system and with every write call exists a write request, therefore, 
WFP monitors write requests." Appellant respectfully disagrees with the Examiner's argument 
and asserts that the mere disclosure of notification when a file has been modified simply fails to 
even suggest that WFP monitors '^requests to write to the files," as claimed by appellant 
Specifically, WPP discloses that "it is notified that a file in a protected folder is modified " 
(bottom Of Page 1 - emphasis added). However, the mere disclosure by WFP of being notified 
when a file is modified simply fails to even suggest that "factors are altered based on the 
monitoring of the requests to write to the files on the computer" (emphasis added), as claimed by 
appellant. Clearly, WFP's notification when a file is modified fails to meet appellant's claimed 
"monitoring of the requests to write to the files," in the manner as claimed by appellant. 

Second, appellant respectfully disagrees with the Examiner's argument that "each time a file [is] 
written (i.e. modified) a write request occurs" such that "the write request [which is] part of the 
change. . . [is] therefore part of the monitoring/' as noted in the Office Action mailed 1/12/06. 
Specifically, WFP only teaches that the "Windows File Protection feature is implemented when 
it is notified that a file in a protected folder is modified " and that "[o]nce the notification is 
received, the Windows File Protection feature determines which file was changed" (emphasis 
added). Thus, in WFP, the monitoring is performed with respect to when an actual modification 
has already been made, and not to when a request to write to the files on the computer is made, in 
the manner claimed by appellant. To emphasize, appellant claims altering factors based on a 
request, and not merely a file modification that has already been made, as in WFP. As such, 
appellant's claim language allows for the "writes to the files on the computer" to be prevented 
such that the modification is not made, in the maimer claimed 

In the Examiner's Answer mailed 08/23/2006, the Examiner has argued that "when a 
modification to a file protected by WFP is made that places it in an incorrect version, it is 
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replaced with the correct version" and that "[t]his replacement is based on the determination that 
the file is an incorrect version, thereby preventing the incorrect version from being written." 
Appellant respectfully disagrees with the Examiner's argument, and asserts that WFP instead 
merely discloses that "it is notified that a file in a protected folder is modified" and that "if the 
file is protected, the Windows File Protection feature looks up the file signature in a catalog to 
determine if the new file is the correct Microsoft version" (bottom of Page 1 - emphasis added). 
Appellant asserts that WFP's disclosure that the file is modified resulting in a new file which 
causes WFP to look up the file signature in a catalog to determine if it is the correct Microsoft 
version, contradicts the Examiner's argument that the WFP's "replacement ... prevents] the 
incorrect version from being written." Again, appellant's claim language allows for the 'Svrites 
to the files on the computer" to be prevented, as claimed, such that the modification to the file is 
not made. Clearly, WFP's disclosure of replacing the new file after it is modified fails to suggest 
preventing "'writes to the files on the computer," in the manner as claimed by appellant 

Further, appellant respectfully asserts that if WFP prevented writes to the file, as asserted by the 
Examiner, then the file would not need to be replaced since the file would be prevented from 
being modified to the incorrect version. Clearly, since WFP discloses that a modified file of an 
incorrect version is replaced with the correct version, WFP fails to meet appellant's claimed 
preventing "writes to the files on the computer," as claimed, and even teaches away. 
Still with respect to the present grouping, and specifically appellant's claimed technique 
"wherein the factors are updated based on the requests," the Examiner has responded to 
appellant's arguments, as noted in the Office Action mailed 1/12/06, by stating that in WFP 
"when a file is changed to an incoirect version, WFP replaces the file with the correct version, 
which is both altering and updating." Appellant respectfully asserts that WFP only teaches 
responding to the actual modifications of files, and not to "update[ing] based on the requests" 
(emphasis added), as claimed by appellant. 

In the Examiner's Answer mailed 08/23/2006, the Examiner has argued that "[a]gain, the file is 
the factor and when the incorrect version of a file is detected it is replaced with the correct 
version based on the detection, i.e. the file is updated to the correct version" and that "monitoring 
for modifications corresponds to monitoring write requests as discussed above." Appellant 
respectfully disagrees with the Examiner's arguments, and respectfully asserts that, in WFP, the 
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file is updated after being modified. Thus, the update is based on the modification, which clearly 
does not meet appellant's claimed "factors [that] are updated based on the requests " (emphasis 
added), as claimed by appellant, where the requests are "requests to write to the files on the 
computer," in the context as claimed by appellant. 

To establish a prima facie case of obviousness, three basic criteria must be met. First, there must 
be some suggestion or motivation, either in the references themselves or in the knowledge 
generally available to one of ordinary skill in the art, to modify the reference or to combine 
reference teachings. Second, there must be a reasonable expectation of success. Finally, the 
prior art reference (or references when combined) must teach or suggest all the claim limitations. 
The teaching or suggestion to make the claimed combination and the reasonable expectation of 
success must both be found in the prior art and not based on applicant's disclosure. In re 
Vaeck$M F,2d488, 20 USPQ2d 1438 (Fed.Cir.1991). 

Appellant respectfully asserts that at least the first and third elements of the prima facie case of 
obviousness have not been met, for the reasons noted above. 

Group #2; Claim 28 

With respect to the present grouping, the Examiner has relied upon pages 1-2 in WFP to make a 
prior art showing of appellant's claimed technique "wherein the at least one of critical files and 
critical file locations are looked up based on requests to write to the at least one of critical files 
and critical file locations on the computer." 

Appellant respectfully asserts that pages 1-2 from WFP merely teach "cachefmg] all protected 
system files'* in order to replace any modified protected files. However, restoring protected 
system files from a cache or installation media after they are modified clearly fails to even 
suggest a technique 'Svherein the at least one of critical files and critical file locations are looked 
up based on requests to write to the at least one of critical files and critical file locations on the 
computer'* (emphasis added), as claimed by appellant. 
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In the Examiner's Answer mailed 08/23/2006, the Examiner has argued that "WFP disclose[s] 
that when a file is modified to an incorrect version, the correct version of that file is looked up 
and replaced with the correct version of the file from a cache as shown on the bottom of page 1 
to the top of page 2 and is therefore looked up based on the request to write." Appellant 
respectfully disagrees with the Examiner's argument and respectfully asserts that WFP merely 
teaches that the "Windows File Protection feature is implemented when it is notified that a file in 
a protected folder is modified " and that "[o]nce the notification is received, the Windows File 
Protection feature determines which file was changed " (emphasis added). Further, WFP teaches 
that "Windows File Protection feature looks up the file signature in a catalog to determine xf the 
new file is the correct Microsoft version" and "[i]f it is not, the file is replaced from the DUcache 
folder " (emphasis added). However, WFP's disclosfure of being notified when a file is modified 
looking up the new file signature to determine if it is the correct version, and replacing it from 
the Dllcache folder simply fails to even suggest a technique £< wherein the at least one of critical 
files and critical file locations are looked up based on requests to write to the at least one of 
critical files and critical file locations on die computer" (emphasis added), as claimed by 
appellant. Clearly, WFP's notification after a file is modified fails to suggest a look up "based 
on requests to write to the at least one of the critical files and critical file locations on the 
computer," in the manner as claimed by appellant, and even teaches away. 

Again, appellant respectfully asserts that at least the first and third elements of the prima facie 
case of obviousness have not been met, for the reasons noted above. 

Group #3: Claims 3 and 1 6 

With respect to the present grouping, the Examiner has relied on page 2 in WFP to make a prior 
art showing of appellant's claimed technique '"wherein the factors are user configurable." 
Appellant respectfully asserts that the only mention of users in the excerpt from WFP is that an 
"administrator [has] the ability to scan all protected files to verify their versions" and that an 
"administrator [is prompted] to insert the appropriate media to replace the file." Clearly, neither 
teaching even suggests user configurable factors, in the manner claimed by appellant. 
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In the Office Action mailed 01/12/2006, the Examiner has responded to appellant's arguments by 
stating that "at the bottom of page 1 WFP teaches that a user can allow a file to be updated and 
therefore the [user] configures a factor." Appellant respectfully disagrees. The bottom of page 1 
in WFP only discloses that the Windows File Protection feature is notified of a file modification 
and that the Windows File Protection feature looks up the file signature in a catalog to determine 
if a new file is the correct Microsoft version. Thus, in WFP P only the Windows File Protection 
feature allows files to be updated, which clearly does not meet appellant's claimed "factors [that] 
are user configurable" (emphasis added). Appellant also notes that the only mention of users in 
WFP discloses that fin "administrator [has] the ability to scan all protected files to verify their 
vetsiofts" and that an "admimstrator [is prompted] to insert the appropriate media to replace the 
file/* Clearly, neither teaching even suggests user configurable factors, in the manner claimed 
by appellant. 

In the Examiner's Answer mailed 08/23/2006, the Examiner has argued that ^age 2 [of] WFP 
states that the cache size can be adjusted by the administrator, therefore depending on the size of 
the cache a different number of factors will be stored and is thereby configurable by the 
administrative user." Appellant respectfully disagrees with the Examiner's argument and asserts 
that WFP merely discloses that "[t]he SFCQuota setting can be made as large or small as needed 
by the system administrator" and "[slotting the SFCQuota value to OxFFFFFFFF causes the 
Windows File Protection feature to cache all protected system files" (emphasis added), 
Appellant respectfully asserts that, as noted by the Examiner, only the cache size can be adjusted, 
where such cache size is used for keeping verified file versions cached. Clearly, in WFP 7 the 
cache size is not a factor in the context claimed by appellant, since appellant claims "factors 
[that] are altered based on the monitoring of the requests to write to the files on the computer" 
(see the independent claims for context). 

Again, appellant respectfully asserts that at least the first and third elements of the prima facie 
case of obviousness have not been met, for the reasons noted above. 

Group #4: Claims 9, 10, 22, and 23 
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With respect to the present grouping, the Examiner has again relied on pages 2-3 in WFP to 
make a prior art showing of appellant's claimed techniques "wherein the factors axe updated 
based on a user request" (Claim 9 et aL) and "wherein the factors are updated from a remote 
location via a network" (Claim 10 et aL). Appellant respectfiilly asserts that WFP only teaches 
responding to modifications of files, and not to requests, as claimed by appellant (Claim 9 et. 
aL). In addition, WFP fails to even mention any sort of updating, and especially not updatiag 
factors, as claimed by appellant (Claims 9 and 10 et aL), but instead only discloses repairing 
incorrect file versions. 

In the Office Action mailed 01/12/2006, the Examiner has responded to appellant's arguments by 
stating that f< when a file is changed to an incorrect version, WFP replaces the file with the correct 
version, which is both altering and updating/' Appellant again respectfully asserts that WFP 
oaly teaches responding to the actual modifications of files, and not to requests, as claimed by 
appellant (Claim 9 et. ai). In addition, WFP fails to even mention updating factors, as claimed 
by appellant (Claims 9 and 10 et aL), but instead only discloses replacing files . 

In the Examiner's Answer mailed 08/23/2006, the Examiner has argued that "the System File 
Checker tool, * gives an administrator the ability to scan all protected files to verify their 
versions' which is a user request to determine when a file is modified and whenever a file is 
modified to an incorrect version it is replaced with the correct version, i.e. update the file, from a 
cache." Further, the Examiner has argued that "[t]his updating of files, from a cache, can be 
from either ! a local path or network path 1 " and "[therefore, WFP discloses updating from a 
remote location via a network." 

Appellant respectfully disagrees with the Examiner's arguments and asserts that WFP merely 
discloses that "[tjhe System File Checker tool gives an administrator the ability to scan all 
protected files to verify their versions" where modified files of an incorrect version are ' Placed 
from the Dllcache folder" (emphasis added). However, the mere disclosure that the System File 
Checker scans and verifies files, and replaces modified files simply fails to suggest that the 
"factors are updated based on a user request" (Claim 9 et aL - emphasis added), in the manner as 
claimed by appellant. 
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Further, WFP discloses that "[t]he SFCDllCacheDir value can either be a local path or a network 
path " (emphasis added). However, the mere disclosure of replacing files from a Dllcache folder 
that may be a network path fails to suggest that the " factors are updated from a remote location 
via a network" (Claim 10 et al. - emphasis added), in the manner as claimed by appellant. 

Again, appellant respectfully asserts that at least the first and third elements of the prima facie 
case of obviousness have not been met, for the reasons noted above. 

Group #5: Claims 12 and 25 

With respect to the present grouping, the Examiner has relied on the bottom of page 2 in WFP to 
make a prior art showing of appellant's claimed technique for "conditionally preventing the 
writes to the files on the computer based on a user confiimation/' Appellant respectfully asserts 
that the excerpt from WFP relied upon by the Examiner merely teaches that "if the affected file 
in use by the operating system is not the correct version or the file is not cached in the Dllcache 
folder, the Windows File Protection feature attempts to locate the installation media." WFP 
continues by teaching that "[i]f the installation media is not found, the Windows File Protection 
feature prompts an administrator to insert the appropriate media to replace the file or the 
Dllcache file version " (emphasis added). Clearly, suggesting to prompt an administrator to insert 
media in order replace the file or Dllcache file, as in WFP, fails to even suggest a technique for 
"conditionally preventing the writes to the files on the computer based on a user confirmation " 
(emphasis added), as claimed by appellant. 

In the Examiner's Answer mailed 08/23/2006, the Examiner has argued that "as discussed above 
WFP prevents the writes to a file and when the file is not found in the cache the system prompts 
a user to insert the appropriate media to replace the file." Further, the Examiner has argued that 
"[w]hen the user inserts the media the file with the correct version is copied from the media and 
replaces the incoirect version of the file in the system thereby preventing the writing of the file 
with the incorrect version" and "[s]ince this situation can only be done with a user inserting the 
media it is based on the users confirmation of the prompt from the WFP." 
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Appellant respectfully disagrees with the Exaiainer's arguments and asserts that the Examiner's 
arguments are contradictory. In particular, the Examiner argues that "WFP prevents the writes to 
a file. . . and prompts a user to insert the appropriate media to replace the file " (emphasis added). 
If WFP prevented the write to the file, as the Examiner has argued, then there would not be any 
need to replace the file since it would not have been written to. Further, WFP merely discloses 
that 6 the Windows File Protection feature prompts an administrator to insert the appropriate 
media to replace the file or the DUcache file version" (emphasis added). Clearly, WFP's 
disclosure of replacing the file after it is modified fails to suggest "conditionally preventing the 
writes to the files on the computer based on a user confirmation " (emphasis added), as claimed 
by appellant- 

Again, appellant respectfully asserts that at least the first and third elements of the prima facie 
case of obviousness have not been met, for the reasons noted above. 

Group #6: Claim 30 

With respect to the present grouping, the Examiner has relied on page 2 in WFP to make a prior 
art showing of appellant's claimed technique "wherein the faxstors include a list of critical files 
such that the list of critical files is updated based on the requests." Appellant respectfully asserts 
that page 2 in WFP teaches that "[a]U SYS, DLL, EXE, TTF, FON and OCX files included on 
the Windows 2000 CD-ROM are protected" and that "[s]etting the SFCQuota value to 
OxFFFFFFFF causes the Windows File Protection feature to cache all protected system files 
(approximately 2,700 files)." Clearly, disclosing that all SYS, DLL, EXE, TTF, FON and OCX 
files are protected and that the SFCQuota value determines the size of the Dllcache folder simply 
fails to even suggest a technique 'Nvherein the factors include a list of critical files such that the 
list of critical files is updated based on the requests " (emphasis added), as claimed by appellant. 

In the Exatminer's Answer mailed 08/23/2006, the Examiner has argued that "when the cache 
does not hold all of the critical files specified on page 2, and a modification is made to a critical 
file not in the list, the media (Windows 200 CD-ROM) is inserted and the list now contains all 
the files and the list is thereby updated based on the modification which corresponds to the write 
requests as described above." 
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Appellant respectfully disagrees with the Examiner's arguments acid asserts that WFP merely 
discloses "[i]f the affected file in use by the operating system is not the correct version or the file 
is not cached in the Dllcache folder, the Windows File Protection feature attempts to locate the 
installation media" and "[i]f the installation media is not found, the Windows File Protection 
feature prompts an administrator to insert the appropriate media to replace the file or the 
Dllcache version " (emphasis added). However, prompting the administrator to insert appropriate 
media to replace the file or the cache version when an affected file is not the correct version or is 
not cached, as in WFP, simply fails to suggest a technique "wherein the factors include a list of 
critical files such that the list of critical files is updated based on the requests" (emphasis added), 
as claimed by appellant Clearly, updating a file in a cache fails to suggest that a "list of critical 
files is updated based on the requests" where the requests are "requests to write to the files on the 
computer" (emphasis added), in the context as claimed by appellant. 

Again, appellant respectfully asserts that at least the first and third elements of the prima facie 
case of obviousness have not beeti met, for the reasons noted above. 

Issue # 2: 

The Examiner has rejected Claims 8, 21, and 31 under 35 U.S,C 103(a) as being unpatentable 
over WFP, in view of Rickey et ah, in view of Stevens (U.S. Publication No, 2002/0133702). 

Group #1: Claim 8 and 21 

With respect to the present grouping, the Examiner has relied upon Page 1 from WFP, and 
Paragraph 0019 from Stevens to make a prior art showing of appellant's claimed technique 
"wherein the factors include trusted applications that initiate the requests," 

"The above five functions implemented by the present invention allow 
the system firmware (BIOS) to detertu.no that a trusted application is 
attempting access and then to grant the requested access. " (Stevens, 
Paragraph 0019 - emphasis added) 
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Appellant respectfully asserts that the excerpt from Stevens merely discloses "allow[ing] the 
system firmware (BIOS) to determine that a trusted application is attempting access and 
then. . . grantlmgl the requested access ' 7 (emphasis added). Clearly, the system firmware granting 
requested access when the system firmware determines that a trusted application is attempting 
access, as in Stevens, simply fails to even suggest a technique therein the factors include 
trusted applications that initiate the requests " (emphasis added), as claimed by appellant. There 
simply is no disclosure in the excerpt from Stevens that a trusted application initiates the request, 
in the manner claimed by appellant. 

In the Examiner's Answer mailed 08/23/2006, the Examiner has argued that "Stevens teaches 
that trusted applications attempting access (therefore requesting access) are granted the requested 
access." Appellant respectfully disagrees and asserts that Stevens merely discloses a trusted 
application attempting access, which fails to even suggest a technique "wherein the factors 
include trusted applications that initiate the requests" (emphasis added), where the requests are 
specifically '"requests to write to the files on the computer" (emphasis added), in the context 
claimed by appellant. 

Again, appellant respectfully asserts that at least the first and third elements of the prima facie 
case of obviousness have not been met, for the reasons noted above. 

Group #2: Claim 31 

With respect to the present grouping, the Examiner has relied on page 1 in WFP to make a prior 
art showing of appellant's claimed technique "wherein if one of the requests is initiated by an 
application that is not one of the trusted applications, a user is alerted and allowed to at least one 
of prevent and permit the request initiated by the application/' Appellant respectfully asserts that 
page 1 from WFP discloses that "[t]he Windows File Protection feature provides protection for 
the system files using two mechanisms." WFP teaches that the first mechanism of "[t]he 
Windows File Protection feature is implemented when it is notified that a file in a protected 
folder is modified." Clearly, the excerpt from WFP fails to even suggest a technique "wherein if 
one of the requests is initiated by an a pplication that is not one of the trusted applications, a user 
is alerted and allowed to at least one of prevent and permit the request initiated by the 
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application" (emphasis added), as claimed by appellant Additionally, appellant respectfully 
asserts that the Windows File Protection feature is invoked only after a file is replaced or deleted, 
and not before. Thus, WPP fails to suggest that "a user is alerted and allowed to at least one of 
prevent and permit the request initiated by the application" (emphasis added), as claimed by 
appellant. 

In the Examiner's Answer mailed 08/23/2006, the Examiner has stated that Claim 31 <4 was 
improperly rejected only under WPP in view of Rickey, when claim 31 depends from claim 8 
which was rejected under WFP in view of Rickey et al and further in view of Stevens and is 
hereby corrected." Further, the Examiner has argued that "WFP teaches altering a user when a 
file is modified, which corresponds to the request to write, in order to replace it with the correct 
version and Stevens teaches allowing a trusted application access and therefore does not allow 
untrusted application access." 

Appellant respectfully disagrees and asserts that WFP merely teaches that "[t]he Windows File 
Protection feature is implemented when it is notified that a file in a protected folder is modified" 
(emphasis added). Further, Stevens discloses "allowing] the system firmware (BIOS) to 
determine that a trusted application is attempting access and then to grant the requested access" 
(emphasis added). However, the mere disclosure that a trusted application attempting access is 
granted the requested access, as in Stevens, and that the Windows File Protection is notified 
when a file is modified, as in WFP, simply fails to suggest a technique "wherein if one of the 
requests is initiated by an application that is not one of the trusted applications* a user is alerted . 
and allowed to at least one of prevent and permit the request initiated by the application" 
(emphasis added), as claimed by appellant. Clearly, Steven's disclosure that trusted applications 
are granted access fails to teach a situation where an "application. . .is not one of the trusted 
applications," in the manner as claimed by appellant Further, WFP's disclosure of notifying 
WFP when a file is modified fails to meet appellant's claimed "user [that] is alerted and allowed 
to at least one of prevent and permit the request," in the manner as claimed by appellant 

Again, appellant respectfully asserts that at least the first and third elements of the prima facie 
case of obviousness have not been met, for the reasons noted above. 
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In view of the remarks set forth hereinabove, all of the independent claims are deemed 
allowable, along with any Claims depending therefrom. 
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OCT. 23. 2006 5:35PM ZILKA-KOTAB, PC 



NO. 4472 P. 16 



In the event a telephone conversation would expedite the prosecution of this application, the 
Examiner may reach the undersigned at (408) 971-2573. For payment of any additional fees due 
in connection with the filing of this paper, the Commissioner is authorized to charge such fees to 
Deposit Account No. 50-1351 (Order No. NAI1PO55/01. 228.01), 




Facsimile: (408)971^660 
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